#1152248 thunderbird: OpenPGP broken with librnp0 0.17.1; requires >= 0.18.1

Package:
thunderbird
Source:
thunderbird
Description:
mail/news client with RSS, chat and integrated spam filter support
Submitter:
Reinhard Prix
Date:
2026-10-27 14:49:03 UTC
Severity:
normal
#1152248#5
Date:
2026-10-27 07:44:18 UTC
From:
To:
Dear Maintainer(s),

After upgrading Thunderbird from 1:140.17.0esr-1~deb13u1 to
1:153.5.1esr-1~deb13u1 on Debian 13 (trixie), OpenPGP no longer
works. The OpenPGP Key Manager is completely empty, and signing
messages fails.

The Error Console reports:

   Error: RNP/OpenPGP library failed to load
   BondOpenPGP.sys.mjs:43:13

The installed librnp0 version is 0.17.1-1+b1. Thunderbird's package
dependency permits librnp0 >= 0.17.0, but RNPLib.sys.mjs inside
/usr/lib/thunderbird/omni.ja specifies:

   const MIN_RNP_VERSION = [0, 18, 1];

It also declares rnp_signature_get_revocation_reason, which is
absent from the installed librnp.so.0.

The profile's populated pubring.gpg and secring.gpg files are
still present. The failure appears to be library initialization.

APT's configured trixie repositories currently offer no compatible
librnp0 update. The forky package requires a newer Botan library,
so installing it is not a straightforward workaround on stable.

Please provide a trixie-compatible RNP library or use Thunderbird's
bundled RNP, and correct the minimum dependency if retaining the
system library.

This resembles the earlier dependency mismatch in bug #1041409.

System: Debian GNU/Linux 13 (trixie), amd64
Thunderbird source: trixie-security
librnp0: 0.17.1-1+b1

Thank you.
Best regards,
Reinhard Prix.